News for hackers. Stuff that matters.

A comment on VDSO, 32-bit time, and seccomp. Parent comment

Re:VDSO, 32-bit time, and seccomp by debatem1 on Saturday August 03, 2019 @09:14PM (#20603860)
But unix domain sockets are not pipes, not least in the important way that you can reliably determine the identity of the other end. That can in some cases be an infoleak, and therefore needs independent access control.
[ Parent | on HN ]
Re:VDSO, 32-bit time, and seccomp by d2mw on Saturday August 03, 2019 @11:15PM (#20604224)
If SCM_CRED passing were a real problem in _any_ scenario, SELinux should target that instead, not an entire subsystem on which half the system is built
[ Parent | on HN ]
Re:VDSO, 32-bit time, and seccomp by debatem1 on Sunday August 04, 2019 @03:48AM (#20605037)
The point is you need the ability to express both "these are the same thing" and "these are different". You can do both with SELinux. What's your alternative?
[ Parent | on HN ]